Date: Fri, 28 Jan 2000 07:27:46 -0500 (EST) From: Omachonu Ogali <oogali@intranova.net> To: Kuzak <kuzak@kuzak.net> Cc: freebsd-stable@FreeBSD.ORG Subject: Re: Odd DoS Message-ID: <Pine.BSF.4.10.10001280723090.13894-100000@hydrant.intranova.net> In-Reply-To: <200001271656.e0RGugR53381@alpha.dgweb.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Nothin extra needs to be added to rc.conf for ICMP_BANDLIM to work, just add 'options ICMP_BANDLIM' to your kernel configuration, and recompile and that should be it. There is one sysctl variable that is added as a result of ICMP_BANDLIM, net.inet.icmp.bandlim, this specifies the number of packets to limit per second, the default is 100pps. Just to let you know... Omachonu Ogali Intranova Networking Group On Thu, 27 Jan 2000, Kuzak wrote: > I upgraded this server to 3.4-STABLE about a week ago after > a long run with 3.2.. Last night it seems to have spontaniously > started coughing up this error. The error seems to coinside > exactly with a large incoming DoS attack that his right at > 16:00. The attack appears all incoming, so I suspect not > stream.c or a variant... If anyone knows what this is please > let me know so I can try to stop it from happening again. In > the end the server remained offline until I could get it rebooted. > > Jan 26 16:05:47 ai /kernel: arplookup 205.134.161.2 failed: host is not on > local network > Jan 26 16:06:24 ai /kernel: arplookup 205.134.161.2 failed: host is not on > local network > Jan 26 16:08:22 ai /kernel: arplookup 205.134.161.2 failed: host is not on > local network > Jan 26 16:09:05 ai last message repeated 91 times > Jan 26 16:12:00 ai last message repeated 4 times > > ( this msg repeats until rebooted )... > > > Also I am interested in compiling ICMP_BANDLIM into > the kernel.. to make it work is there anything beyond adding > it to the kernel that need be done, such as adding something > to the rc.conf? > -Aric > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-stable" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.10.10001280723090.13894-100000>